What happened
Multiple Atlassian products including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye have been found to contain a vulnerability that allows unauthenticated external parties to access specific files within the web application root directory. This vulnerability is associated with components that have files or directories accessible to external actors, exposing the affected systems to potential compromise.
The vulnerability has been confirmed as actively exploited in the wild, indicating that malicious actors are currently taking advantage of this flaw to access sensitive information. The underlying weakness is classified as CWE-552, which pertains to the improper control of a resource, leading to unintended access.
In response to the vulnerability, authorities including CISA have advised that impacted organisations implement mitigations following the vendor’s instructions. The focus is on ensuring compliance with the guidance outlined in CISA’s BOD 26-04, which prioritizes security updates based on risk. If mitigations are not available or cannot be implemented promptly, discontinuing use of the affected products should be considered.
Who is affected
Organisations running the affected versions of Atlassian Data Centre products, including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye, are impacted by this vulnerability. Any deployment with accessible web application directories may be vulnerable to unauthenticated access, particularly when exposed to the internet.
Stakeholders responsible for maintaining these systems should assess their exposure and ensure appropriate security measures are applied according to the prescribed guidelines, prioritising mitigation efforts where internet-facing services are involved.
Recommended actions
Apply mitigations following the vendor’s instructions for affected Atlassian products.
Ensure compliance with CISA’s BOD 26-04 guidance on prioritising security updates based on risk.
Evaluate the internet exposure of each affected asset, especially those accessible externally.
If mitigations are unavailable or insufficient, consider discontinuing use of the affected products to prevent further exploitation.
Monitor for any signs of compromise and adhere to forensic triage requirements as specified by relevant guidance.
